Reporting a security problem

How to report something

Email admin@alyeska.app with what you found and enough detail for us to reproduce it: the URL or screen, the account or household you were signed in as, what you expected, and what happened instead. A screenshot or a short recording helps more than a long description.

There is no separate security address and no bug bounty program. admin@alyeska.app is read by the person who wrote the app.

What happens after you send it

• We acknowledge your report within 3 business days.
• We tell you whether we could reproduce it, usually within 7 days.
• We tell you when it is fixed, and we credit you by name if you want that.
• If we decide not to fix something, we say so and why, rather than going quiet.

If personal information was exposed

If we confirm that a security problem exposed personal information, we notify the affected households without undue delay and no later than 72 hours after we confirm it, by email to the address each account signs in with. The notice says what happened, what information was involved, what we have done, and what — if anything — the household should do. We notify regulators where the law requires it, on the timelines the law sets.

We would rather send a notice that turns out to be cautious than sit on an unclear one. A beta is not a reason to tell somebody less.

Testing in good faith

If you are looking for problems in good faith and you stay inside the lines below, we will not pursue a legal claim against you or ask anybody else to, and we will not close your beta account over it.

• Use your own account and your own household, or one whose members asked you to test it.
• Stop as soon as you have proved a problem exists — do not read, keep, or share another household's information.
• Do not change or delete anybody else's data, and do not lock anybody out.
• Do not run load tests, denial-of-service attempts, or anything that degrades the service for the families using it.
• Do not use social engineering, phishing, or physical access against us or our testers.
• Give us a reasonable chance to fix it before you write about it publicly.

What is in scope

The app at alyeska.app and its API, and the email address the app forwards booking confirmations to. Reports about our third-party providers — Supabase, Vercel, Google, Resend — should go to those providers, though we are glad to know about them.

Findings we already know about and have written down: the beta is a private test with a small number of households, and some hardening work is deliberately scheduled rather than done. If you report something already on that list we will tell you so.

If we do not answer

If you have emailed admin@alyeska.app and heard nothing for 5 business days, send it again with URGENT in the subject line. A report that reached nobody is the failure this page exists to prevent.